Page MenuHomeFreeBSD

D58541.diff
No OneTemporary

D58541.diff

diff --git a/libexec/rtld-elf/map_object.c b/libexec/rtld-elf/map_object.c
--- a/libexec/rtld-elf/map_object.c
+++ b/libexec/rtld-elf/map_object.c
@@ -123,6 +123,12 @@
break;
case PT_LOAD:
+ if (phdr->p_memsz < phdr->p_filesz) {
+ _rtld_error("%s: invalid PT_LOAD segment",
+ path);
+ goto error;
+ }
+
segs[++nsegs] = phdr;
if ((segs[nsegs]->p_align & (page_size - 1)) != 0) {
_rtld_error(
@@ -147,6 +153,12 @@
break;
case PT_TLS:
+ if (phdr->p_memsz < phdr->p_filesz) {
+ _rtld_error("%s: invalid PT_TLS segment",
+ path);
+ goto error;
+ }
+
phtls = phdr;
break;
diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -1748,6 +1748,12 @@
break;
case PT_TLS:
+ if (ph->p_memsz < ph->p_filesz) {
+ _rtld_error("%s: invalid PT_TLS segment",
+ path);
+ return (NULL);
+ }
+
obj->tlsindex = 1;
obj->tlssize = ph->p_memsz;
obj->tlsalign = ph->p_align;

File Metadata

Mime Type
text/plain
Expires
Sat, Aug 1, 12:42 PM (5 h, 19 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35821827
Default Alt Text
D58541.diff (1 KB)

Event Timeline